- Zope-Announce - Zope lists

Zope 2.12.2, 2.11.5, 2.10.10 released
by Andreas Jung 22 Dec '09

22 Dec '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On behalf of the Zope developers community I am pleased to announce the release of http://pypi.python.org/pypi/Zope2/2.12.2 http://pypi.python.org/pypi/Zope2#zope-2-12-2-2009-12-22 http://www.zope.org/Products/Zope/2.11.5 http://www.zope.org/Products/Zope/2.11.5/CHANGES.txt/ http://www.zope.org/Products/Zope/2.10.10 http://www.zope.org/Products/Zope/2.10.10/CHANGES.txt Andreas - -- ZOPYX Ltd. & Co KG \ zopyx group Charlottenstr. 37/1 \ The full-service network for your D-72070 Tübingen \ Python, Zope and Plone projects www.zopyx.com, info(a)zopyx.com \ www.zopyxgroup.com - ------------------------------------------------------------------------ E-Publishing, Python, Zope & Plone development, Consulting -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iEYEARECAAYFAkswd7kACgkQCJIWIbr9KYxc8gCdEfEuJjJvu5WM6sDECU0maytv FKIAn2Mj5t0+chBBgaAyoeERfPgVbBqc =Di8N -----END PGP SIGNATURE-----

1 0

KMKey 3 Makhno released
by Santi Camps 03 Dec '09

03 Dec '09

We are preasure to announce a new release of KMKey, named Makhno. You can get it from https://forge.osor.eu/projects/kmkey/ Knowledge Management Key (KMKey) is a web based open source knowledge management software that join three solutions on the same collaborative platform * KMKey Project: for planning, managing and controlling your project portfolio * KMKey Quality: to manage your Quality System. * KMKey HelpDesk: for your maintenance and support department News in this version are: - ** Usability improvements in filters, planning and management - Project patterns export / import - New resources load view when assigning works - New Control / Gantt comparing plan and real - New screens to define permissions in a easy way - New tools for administrators: easier to define permissions way and more options to define project's patterns Very important performance improvements Hope enjoy it -- Santi Camps KMKey hacker (http://www.kmkey.com) Earcon S.L. (http://www.earcon.com)

1 0

Grok 1.0 released!
by Jan-Wijbrand Kolman 07 Oct '09

07 Oct '09

The Grok_ development team is very happy to release Grok 1.0. Grok 1.0 is the culmination of 3 years of work after the start of the Grok project in late 2006. It presents a stable platform for developing powerful, extensible web applications. Grok is the result of years of work by the large Grok development team. With Grok, simple projects are easy to create, but it is with increasing complexity and reuse that the Grok framework excels. Grok 1.0 is not the end of Grok development. Since Grok is extensible many powerful new features are being made available as growing collection of extension packages. The Grok development team is also working on a whole range of initiatives to improve Grok even further. The Grok documentation team is also busily working on improving Grok's extensive documentation resources. .. _Grok: http://grok.zope.org See the more extensive announcement here for more information: http://grok.zope.org/project/releases/1.0 About Grok ----------------- Grok is a modern Python-based web framework. Grok is powerful in the hands of an expert developer, as it excels in reuse and extensibility thanks to its use of a component development model. At the same time Grok aims to let less experienced developers be productive immediately, so that the walk up the learning curve is more smooth for them. Grok lets you store your Python objects easily in the battle-tested ZODB, an object database. Alternatively relational databases are supported with Grok, using the `megrok.rdb`_ extension and SQLAlchemy. .. _`megrok.rdb`: http://pypi.python.org/pypi/megrok.rdb Grok is developed in the Zope community and is built with Zope technologies. In particular, Grok builds on the `Zope Toolkit`_, a collection of libraries that make use of a common component development model, the Zope Component Architecture. The Zope community has more than a decade of experience in developing web applications with Python. The Zope Toolkit is the result of this experience, .. _`Zope Toolkit`: http://docs.zope.org/zopetoolkit/ Grok is WSGI compatible and can therefore be integrated with the wide range of WSGI-based technologies available in the Python world today. Grok technologies themselves are also available for reuse. This has enabled developers to use them in combination with the Silva and Plone CMS projects, which work with the Zope 2 application server. regards, The Grok Team

1 0

ZClasses resurrected
by Dieter Maurer 03 Oct '09

03 Oct '09

The Zope developers have ripped out the ZClasses functionality from the Zope core in version 2.12. As promised, I have collected the former code in a new package ("dm.zopepatches.zclasses" on PyPI). When imported, this package uses monkey patching to restore the ZClasses functionality. New tests verify the functionality as formerly described in the Zope book (2.7 edition). To make "ZClasses" available again, the ZODB root database requires "dm.zopepatches.zclasses.ClassFactory" as "class-factory" option in the Zope configuration file. When this option is processed, the package is imported and the monkey patching takes place. The current version does not yet restore the "distribution" functionality (of Zope products). Let me know when you need this functionality. -- Dieter

1 0

Zope 2.12.0 released
by Andreas Jung 01 Oct '09

01 Oct '09

On behalf of the Zope 2 developers community I am pleased to announce the official release of Zope 2.12.0. Major changes: - Ships with ZODB 3.9 - Runs on top of Python 2.5 and 2.6 (no official support for Python 2.4, your mileage may vary) - Fully eggified - you install Zope 2.12 directly from PyPI using *easy_install* or *zc.buildout* - Lots of cleanup on the module level (e.g. ZClasses have gone forever - like it or not) - Ships with the Zope component library (aka Zope 3.4) - RESTified documentation in order to generate nice looking HTML/PDF documents using Sphinx - lots of other small details For more details, check: http://docs.zope.org/zope2/releases/2.12/WHATSNEW.html Release notes: http://docs.zope.org/zope2/releases/2.12/CHANGES.html Especially read the installation instructions since the installation process is different from all other Zope versions (because of the eggification process). Keep in mind that we do no longer provide the traditional all-in-one source tarball: http://docs.zope.org/zope2/releases/2.12/INSTALL.html The official Zope 2.12 project page on PyPI can be found here: http://pypi.python.org/pypi/Zope2/ If you have found a bug, please report it on Launchpad: https://bugs.launchpad.net/zope2/ I would like to thank all people having contributed to this release. Special thanks to Tres Seaver for his tireless efforts in fixing bugs and maintaining the Zope 2 codebase and Hanno Schlichting who worked hard and steadfast on the eggification of Zope 2 and on the cleanup of various dark corners of the Zope 2 codebase. In addition we launched the dedicated zope2.zope.org microsite today. This is one of the first steps for relaunching the Zope sites (including www.zope.org) asap. Andreas Jung Zope 2 Release Manager -- ZOPYX Ltd. & Co KG \ ZOPYX & Friends Charlottenstr. 37/1 \ The experts for your Python, Zope and D-72070 Tübingen \ Plone projects www.zopyx.com, info(a)zopyx.com \ www.zopyx.de/friends, friends(a)zopyx.de ------------------------------------------------------------------------ E-Publishing, Python, Zope & Plone development, Consulting

1 0

zope2.zope.org launched
by Andreas Jung 01 Oct '09

01 Oct '09

I am pleased to announce the launch of a new website dedicated to the Zope 2 application server: zope2.zope.org This site gives the Zope 2 application a much better representation on the web (which was more than necessary after having lived for years with the current old www.zope.org site). zope2.zope.org is not a community site. You will not be able to register or upload personal content (use www.zope.org for the time being). We will publish content on request (events, news etc.) - please contact the webmaster in such a case. It took more than half a year in order to get this site done and I would like to thank the following people for their involvement in this project: - Alma Ong (Design) - Robert Rottermann and Gerhard Hug (implementation of the Plone theme) - Jens Vagelpohl (server setup, technical support, content review) - Matthew Wilkes (content review) - Sidnei da Silva (moving Zope 2 downloads to Launchpad) - Michael Haubenwaller (the Zope webmaster) Andreas Jung Zope 2 Release Manager

1 0

Grok 1.0b2 released!
by Martijn Faassen 17 Sep '09

17 Sep '09

Hi there, The Grok team is happy to announce the release of Grok 1.0b2. With Grok 1.0 we will deliver a stable, powerful, featureful framework for Python-based web development. Grok 1.0b2 is feature complete for Grok 1.0. We hope it is the final beta before Grok 1.0 final. Changes Grok 1.0b2 has the following changes compared to Grok 1.0a4: * grokproject layout changed again. we store the database and logfiles under the var directory in the buildout. * Running the server with debug.ini and the exception middleware in there won't require you to use a different login location for the admin ui. Just going to http://localhost:8080 should give you a login prompt. This release also contains a number of bugfixes. This is actually the first beta of Grok 1.0; beta 1 should be ignored and we consider it not officially released. See the more extensive announcement here for more information: http://grok.zope.org/project/releases/1.0b2 Regards, Martijn

1 0

CVE-2009-2701: Releases to fix ZODB ZEO server vulnerability
by Jim Fulton 01 Sep '09

01 Sep '09

A vulnerability has been found in the Zope Object Database (ZODB) Zope Enterprise Objects (ZEO) server implementation that allows any file readable by the server to be read by clients and any file removable by the server to be removed. The vulnerability only applies if - you are using ZEO to share a database among multiple applications or application instances, - you allow untrused clients to connect to your ZEO server, and - the ZEO server is configured to support blobs. The vulnerability was introduced in ZODB 3.8. Overview -------- This vulnerability is addressed by updates to ZODB. A new release of ZODB is available here: http://pypi.python.org/pypi/ZODB3/3.8.3 (There is also a new development release at http://pypi.python.org/pypi/ZODB3/3.9.0c2.) If you are using blobs, we recommend updating any ZEO storage servers you're running to ZODB 3.8.3 (or ZODB 3.9.0c2). These versions support ZEO clients as old as ZODB 3.2. It isn't necessary to update client software (such as Zope application servers). Restricting access to ZEO storage servers ----------------------------------------- It is very important to restrict write access to ZODB databases. These releases only protect against vulnerabilities in the ZEO network protocol. ZODB uses Python pickles to store data. Loading data from the database can cause arbitrary code to be executed as part of object deserialization. Clients have full access to manipulate database data. For this reason, it is very important that only trusted clients be allowed to write to ZODB databases. Jim -- Jim Fulton

1 0

CVE-2009-0668 and CVE-2009-0669: Releases to fix ZODB ZEO server vulnerabilities
by Jim Fulton 06 Aug '09

06 Aug '09

Vulnerabilities have been found in the Zope Object Database (ZODB) Zope Enterprise Objects (ZEO) network protocol that allow: CVE-2009-0668 Arbitrary Python code execution in ZODB ZEO storage servers CVE-2009-0669 Authentication bypass in ZODB ZEO storage servers The vulnerabilities only apply if you are using ZEO to share a database among multiple applications or application instances and if untrusted clients are able to connect to your ZEO servers. The first vulnerability (CVE-2009-0668) was introduced in ZODB 3.3 (Zope 2.8). The second vulnerability (CVE-2009-0669) was introduced in ZODB 3.2 (Zope 2.7). Overview These vulnerabilities are addressed by updates to ZODB. Newer releases of Zope are also being provided for people who get ZODB with Zope releases. A new release of ZODB is available here: http://pypi.python.org/pypi/ZODB3/3.8.2 (There is also a new development release at http://pypi.python.org/pypi/ZODB3/3.9.0b5.) New Zope releases that include the fixes can be found here: http://www.zope.org/Products/Zope/2.10.9 http://www.zope.org/Products/Zope/2.11.4 http://www.zope.org/Products/Zope/2.8.11 http://www.zope.org/Products/Zope/2.9.11 http://www.zope.org/Products/Zope3/3.1.1 http://www.zope.org/Products/Zope3/3.2.4 http://www.zope.org/Products/Zope3/3.3.3 http://www.zope.org/Products/Zope3/3.4.1 We recommend updating any ZEO storoage servers you're running to ZODB 3.8.2 (or ZODB 3.9.0b5) or to ZODB software provided with the Zope releases listed above. These versions support ZEO clients as old as ZODB 3.2. It isn't necessary to update client software (such as Zope application servers). Restricting access to ZEO storage servers It is very important to restrict write access to ZODB databases. These releases only protect against vulnerabilities in the ZEO network protocol. ZODB uses Python pickles to store data. Loading data from the database can cause arbitrary code to be executed as part of object deserialization. Clients have full access to manipulate database data. For this reason, it is very important that only trusted clients be allowed to write to ZODB databases. Jim -- Jim Fulton

1 0

Participant registration opened for annual German Zope conference
by Christian Theune 29 Jul '09

29 Jul '09

Hi there, the German-speaking Zope Users Group is having their annual Zope conference in September and participants registration just opened. This years conference is featuring Martin v. Loewis, Lennart Regebro and Hanno Schlichting as Keynote speakers as well as, regular talks, lightning talks, a specially prepared Open Space area, tutorials, sprints, and more in the center of Munich (Bavaria). So, if you'd like to join us, please sign up now and get the early bird rate of only 30 EUR: http://www.zope.de/conference/2009 Language warning and unwarning ------------------------------ Please note that the official programme will be mainly in German to accommodate our main focus group of locals. However, we try to integrate all visitors and people are very friendly, so feel free to join us even if you're not speaking German -- you'll find plenty of people to talk to and code with. If you want to join and are having trouble with the registration system, feel free to mail us at email(a)dzug.org asking for assistance. Cheers, Christian -- Christian Theune · ct(a)gocept.com gocept gmbh & co. kg · forsterstraße 29 · 06112 halle (saale) · germany http://gocept.com · tel +49 345 1229889 0 · fax +49 345 1229889 1 Zope and Plone consulting and development

1 0